Executive brief
The Linux kernel's pin controller (pinctrl) subsystem contains a memory leak in the generic pinctrl-to-map conversion function. When device tree configuration parsing fails at certain stages, allocated memory structures are not freed, resulting in memory leaks across all drivers that use generic pinctrl configuration. While this is a memory management issue rather than an exploitable security flaw, it can cause resource exhaustion and system instability over time.
Technical details
This is a resource leak vulnerability in the pinctrl_generic_to_map() function in drivers/pinctrl/pinctrl-generic.c. The function allocates pinctrl map structures via pinctrl_utils_reserve_map() during device tree configuration parsing. If any of the subsequent operations (pinctrl_utils_add_map_mux(), pinctrl_generic_add_group(), pinconf_generic_parse_dt_config(), or pinctrl_utils_add_map_configs()) return an error, the function returns without calling pinctrl_utils_free_map() to release the allocated memory. The fix adds a proper error path that calls pinctrl_utils_free_map() and resets map pointers and counters before returning the error code.
Affected products
- Linux Linux kernel multiple versions (see stable branches linux-4.x through linux-7.x)
Timeline
- 2026-09-17: disclosed: CVE-2026-90340 published
- 2026-08-03: patched: Upstream fix committed by Linus Walleij
- 2026-09-14: patched: Fix backported to stable kernel trees